Hacking attacks can turn off heart monitors
Lock up your grannies
Customer Success Testimonial: Recovery is Everything
American researchers have proven it's possible to maliciously turn off individuals' heart monitors through a wireless hacking attack.
Many thousands of people across the world have the monitors, medically known as implantable cardiac defibrillators (ICDs), installed to help their hearts beat regularly.
ICDs treat abnormal heart conditions; more recent models also incorporate the abilities of a Pacemaker. Their function is to speed up a heartbeat which is too slow, or to deliver an electrical shock to a heart which is beating too quickly.
According to the research (pdf) by the Medical Device Security Center - which is backed by the Harvard Medical School among others - hackers would be able to intercept medical information on the patient, turn off the device, or, even worse, deliver an unnecessary electrical shock to the patient.
The hack takes advantage of the fact the ICD possesses a radio which is designed to allow reprogramming by a hospital doctor. The ICD's radio signals are not encrypted, the Security Center said.
The Security Center demonstrated the hack on an ICD made by Medtronic using a PC, radio hardware and an antenna. The ICD was not in a patient at the time. The research is detailed in a report released today.
The report reveals that a hacker could "render the ICD incapable of responding to dangerous cardiac events. A malicious person could also make the ICD deliver a shock that could induce ventricular fibrillation, a potentially lethal arrhythmia."
The Security Center says manufacturers of ICDs could implement several measures to prevent the threat. These include making the IMD produce an audible alert when an unauthorised party tries to communicate with their IMD. It also suggests employing cryptography to provide secure authentication for doctors.
The researchers added that the risk facing patients is negligible. "We believe the risk to patients is low and that patients should not be alarmed," it said in the report.
"We do not know of a single case where an IMD patient has ever been harmed by a malicious security attack."
It added that hackers would need to be physically close to their intended victim and would need sophisticated equipment. The kit used in the demoed attack cost $30,000.
The researchers omitted their methodology from the paper to help prevent such an attack ever happening, they said.
Medtronic said the chance of such an attack is "extremely low". Future versions of its IMDs, which will send radio signals ten metres, will incorporate stronger security, it told the Associated Press. ®
COMMENTS
if only
**quietly awaits the release of ineritance_now.exe **
A lot cheaper than 30K
That kit may have cost 30K, but I am betting it can be do for under 1K, probably about $400.
Well it is a dog eat dog world, I wouldn't put is past some young exec to put 1 and 1 together, and see that getting to the top may involve a bit of heartbreak.
It use to be the case that the medical world was off limits to hackers, a sort of unwritten agreement, but with governments using the medical world to build the id databases, that has sort of been rescinded. Bit like using the red cross for spying missions, they are now targets because of it.
I would imagine that EMP devices would be on the up as well, there I would blame speed cameras, people are taking axle grinders to them, how much easier would it be to just zap them. And of course EMP could be used against a slew of modern security surveillance devices, with the side effect of knocking out the cyborgs with unprotected pace makers.
Needs to be close by.
Having done some work for one of these companies (it was a few years ago!) my understanding is that the "controller" (actually a laptop PC) needs to be in close proximity to the "subject". They usually use "induction", not radio frequency to couple to the device implanted (at least that is what I saw).
Yes, security is not something the device vendors, or the FDA thinks about. Lots of medical devices have "unpatched" windows environments because the vendors haven't gone thru the process of verification with the latest of windows patches. Most of the time these computers are not connected to a network (they usually don't need to be!), but sometimes they do get connected, and then the malware arrives with evil intentions.
On the ICD I did some work on they used a 65C02 processor, which they needed to get certified outside the normal supply chain (look at any datasheet for ICs and it usually says "not for life critical..."). Then they need to get ALL the software to pass FDA rules (lots of time and $$$). By the time everything is done, the development cost is HUGE. Then they deploy the stuff, and the added cost of a laptop per inplantable device is "small potatoes", so they just build it into the kit.
In my book the big problem is the controlling box (laptop) used to program the implant to do its thing (parameters per subject). As usual, security isn't a big consideration since most of the development is in an isolated environment.
It was interesting how the company "solved" problems in the test environment. It ended up being 4 (yes four) Windows boxes (it was W95) and a logic analyzer to test the ICD which had a 65C02 processor (same as Apple 2). Need something, add more hardware! In order to get the timing for the network between the 4 cpu's right, they even incorporated a relay to cutoff the network from outside the 4 cpu's. Oh, well. It was windows, they didn't even try anything else.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
